Password Manager User Forgets Master Password, Achieves Total Security

A man who migrated all 247 of his online account passwords to a password manager with randomly generated 32-character strings has achieved what security experts describe as "theoretically perfect security" after forgetting his master password. Devin Vault, 36, spent an entire weekend in January transitioning every online account from his previous system (the same password with a number appended, incrementing by one for each account) to unique, cryptographically random passwords generated by his new password manager. "Each password contained uppercase, lowercase, numbers, and special characters in a random sequence that no human could memorize," Vault said. "That was the point. The idea was that I'd only need to remember one master password. I remember it being something about my childhood dog. Or my mother's maiden name. Or a street I lived on. It had a number. Or an exclamation point. One of those." Vault's recovery options are limited. The password manager's emergency access feature requires a designated recovery contact, which Vault set as his own secondary email address, the password to which is stored in the password manager. His account recovery email goes to a third email address, also in the password manager. "It's a closed loop of security," admitted Vault. "Nobody can get in. Including me. From a threat modeling perspective, this is actually the most secure state possible. My data is protected from all adversaries, up to and including myself." Vault has spent three weeks attempting to recall the master password, filling seven pages of a notebook with guesses. He has tried every pet name, street name, and significant date in his life, along with 340 variations involving capitalization and special characters. He has since created new accounts for essential services using a fresh email address. His new password system is a physical notebook kept in his desk drawer. When asked if this represented a security regression, he said: "My desk drawer has never asked me for a master password and then locked me out for too many failed attempts."